wolfSSL now has a community-maintained Zig binding—zig-wolfssl—that wraps wolfSSL and wolfCrypt behind a native Zig API. If you are building a Zig application that needs TLS, X.509, or wolfCrypt algorithms, this binding gives you type-safe access without dropping to raw C.
New to Zig? Check out the official overview or visit ziglang.org.
What’s Covered
The binding exposes five core modules:
- tls: TLS 1.2/1.3 and DTLS (client and server), with SNI, ALPN, session resumption, and certificate chain verification
- crypto: AES (GCM/CBC/CTR), ChaCha20-Poly1305, RSA, ECC (P-256/384/521, SECP256K1), Ed25519/Ed448, Curve25519/X448, FFDHE, SHA-1/2/3, BLAKE2, HMAC, AES-CMAC
- x509 — Certificate parsing and chain verification (PEM/DER), certificate manager
- kdf — HKDF, PBKDF1, PBKDF2, scrypt
- random — CSPRNG
Zig-Native Design
This binding goes beyond a thin @cImport wrapper. Key design choices include:
Single C Import Point
All wolfSSL C types flow through a single src/c.zig module. This avoids type identity issues caused by multiple @cImport blocks generating incompatible definitions.
Comptime feature detection
Using @hasDecl() at compile time to probe which algorithms your wolfSSL build was configured with. Code that calls a disabled algorithm fails at compile time, not at runtime.
Zig Allocator Bridge
You can hook wolfCrypt’s internal malloc/realloc/free into any Zig allocator — including the provided SecureAllocator, which zeroes memory before freeing. Useful for key material.
Errors as Error Sets
wolfSSL’s numeric error codes are mapped to named Zig error values (`TlsError`, `CryptoError`) so you get exhaustive switch coverage and readable stack traces.
FIPS support
The binding links against your locally built and installed wolfSSL library and inherits whatever that build provides. If you are running against a FIPS-validated wolfSSL build, the algorithms route through the validated boundary as they normally would. The binding does not interpose on that path.
FFI Escape Hatch
Not everything is wrapped yet. The binding exposes pub const ffi for
direct access to the underlying C API. DTLS server, post-quantum KEMs,
PKCS#12, certificate generation, and hardware backends are noted as
current gaps. The ffi surface is explicitly not stable across
wolfSSL versions.
Getting Started
zig build test -Dwolfssl-src=/path/to/wolfssl
Where to get it
The library is at github.com/wolfssl/zig-wolfssl and is licensed under GPL-3.0 with commercial licensing available from wolfSSL.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now